jake
09/16/2021, 9:14 PM\\.\pipe\osquery.em
Tomas Touceda
09/16/2021, 9:47 PMC:\Program Files\Orbit\osquery.em
. Orbit does create that directory at the beginningjake
09/16/2021, 10:19 PMTomas Touceda
09/17/2021, 4:25 PMjake
09/17/2021, 4:51 PMspec:
agent_options:
config:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
options:
allow_unsafe: true
disable_distributed: false
disable_events: false
disable_extensions: false
distributed_interval: 10
distributed_plugin: tls
distributed_tls_max_attempts: 3
enable_ntfs_event_publisher: true
enable_powershell_events_publisher: true
enable_windows_events_publisher: true
enable_windows_events_subscriber: true
extensions_autoload: \Program Files\osquery\extensions.load
extensions_require: trailofbits_osquery_extensions,plgx_win_extension
logger_kafka_acks: all
logger_kafka_brokers: <plaintext://kafka.brokk.taom.dev:9092>
logger_kafka_topic: fleettest
logger_plugin: tls
logger_tls_endpoint: /api/v1/osquery/log
logger_tls_period: 10
ntfs_event_publisher_debug: true
pack_delimiter: /
verbose: true
In theory when using orbit it should start those extensions. When I query all the flags, everything is in place as it should based off the options.
When using Orbit, it does not launch the extensions. If you use Orbit with Flagfiles, it does not launch it.
But if I use osqueryd with the exact same flagfile it launches.zwass
extensions_autoload
as part of the config. It must be part of the flagfile.jake
09/17/2021, 5:13 PMzwass
jake
09/17/2021, 5:18 PMzwass
jake
09/17/2021, 5:27 PM